A computer network is a collection of interconnected computing devices that exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets. The packets are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
Certain devices within the network, such as routers, maintain routing information that describes routes through the network. Each route defines a path between two locations on the network. From the routing information, the routers may generate forwarding information, which is used by the routers to relay packet flows through the network and, more particularly to relay the packet flows to a next hop. In reference to forwarding a packet, the “next hop” from a network router typically refers to a neighboring device along a given route. Conventional routers often maintain the forwarding information in the form of one or more forwarding tables. Upon receiving an incoming packet, the router examines information within the packet to identify the destination for the packet. Based on the destination, the router forwards the packet in accordance with one of the forwarding tables.
The routers may further apply packet filters to packet flows through the routers. For example, the router may compare header information within the packet to a set of filtering rules, sometimes referred to as “terms”. The filtering rules may specify, for example, particular source IP address, destination IP addresses, and other criteria for filtering packets. Specifically, the router identifies packets from the packet flows that match the filtering rules, and performs an associated action on the packet depending on which filtering rule the packet matched. The action may include dropping the packet, remarking the packet as lower priority, counting packets that match the filtering rule, and the like. For example, the router may drop packets having a source IP address of a device sourcing a denial of service (DoS) attack by applying a filtering rule for the source IP address dropping any packets matching the filter rule. Conventional routers typically apply the filters to packet flows based on the interfaces from with the flows are received, i.e., on an interface-by-interface basis. For instance, the router may apply an interface-specific filter to each of the packet flows received by a given interface. Alternatively, the routers may apply a single packet filter to all packet flows regardless of the interface from which the packet.